skysight-inc/HackerNews huggingface dataset:
These days, even a very cheap ARM core has enough horsepower to run ChaCha20 w/ Poly1305 over every packet plus one Curve25519 multiplication per subscriber every 24 hours, plus generating and signing one Curve25519 short-term Diffie-Hellman key every hour.

Using a shared symmetric ChaCha20 w/ Poly1305 key to encrypt and authenticate the client's sign-on Curve255 exchange, you'd get a variety of usage modes for free without adding any special cases to the access point's side of the protocol.

The basic use case is that your device knows the password, so it listens for the periodic SSID announcement with the signed short-term DH public key. Your device then performs its side of the DH key agreement, and encrypts-and-MACs the public value with the password-derived key. The access point decrypts your public DH value, completes key agreement, and uses the agreed key to encrypt your short session ID, its expiry time, and a 256-bit ChaCha20/Poly1305 key[0] for the session, and send it back to your device.

In the case of temporarily granting access to a guest, the guest's device would generate a public DH value and send it to you. You'd then encrypt-and-MAC that exchange message and send it back to your friend's device. The friend's device would then be able to forward the DH exchange to the access point and sign on once. They'd have a session ID and encryption key that's valid until expiry.

In the case of a coffee shop granting temporary access to a paying customer, the phone could put its ephemeral public DH value in a QR code, and the cash register could scan the QR code, encrypt-and-MAC the public DH parameter, and directly send the value to the access point, at which point the customer's device could sniff and decrypt the sign-on message to learn its session ID and session key.

Each device gets its own session ID and session key, so they can't eavesdrop on each other.

If Curve22519 ends up getting broken, an attacker would still need to break ChaCha20 or learn the password in order to grab session keys. The client-side DH parameter still holds 252 bits of entropy (Curve25519's cofactor is 8, so the generator generates a 2*252 subgroup), and computing an Elliptic curve logarithm on this value still requires first decrypting the ChaCha20-encrypted sign-on message.

You wouldn't get perfect forward secrecy, but you would get forward secrecy through the timed key rotation of both the short-term DH keys and rotation of any symmetric keys used to avoid storing any per-session state in the access point.

[0] The session encryption key wouldn't simply be the DH-agreed key in order to allow the access point to avoid keeping per-session state and instead derive session keys from session IDs using periodically rotating symmetric encryption keys known only to it. The access point would need to guard against session IDs rolling over faster than they expired (and expiry would need to coincide with key rotation), but it's a simple check.
> I hope I'm wrong but I see no way how this battle can be won in the long run.

I mean, this problem is actually very simple to fix: make advertising a felony. There's no way that's ever going to happen, but it is simple, easy to see, and effective.
Comments moved to https://news.ycombinator.com/item?id=25930214.
I can understand plant based snacks. But plant based drinks? Aren't most soft drinks made from water and sucrose based corn syrup? Maybe a protein shake?
Soteris (YC S19) is hiring employees #4-5 – cloud and data infrastructure
In absolute temperature, there isn't much difference between 273K and 260K....
I still don't understand why anyone would trust Ethereum after the DAO reversal. The code is law, except when it's inconvenient for the creators.

Doing that kind of stuff defeats the whole purpose of cryptocurrencies, IMO.
>So is this your viewpoint on all forms of diversity, such as racial and socioeconomic inclusion?

Yes. Although in the US we've been working on socioeconomic and racial inclusion for the last few centuries so I feel that's moving slowly enough for society to adjust. Communism shows what happens when you move on the socioeconomic side too quickly and it's not pretty.

I do find it funny how some people think racial and socioeconomic inclusion is a new thing that is just now happening. Do you people never pay attention to history, ever?

>This has nothing to do with what we're discussing here.

You talked about the glory of change in terms of SV. I mentioned the dark flip side of change in terms of SV. You can try to cherry pick parts of the story but I'll keep pointing out that you're doing so.
STUN doesn't relay. It assists with P2P connection setup. TURN relays, and is intended as the path of last resort. The vast majority of WebRTC traffic is P2P.
We had a similar issue with our school always ringing my wife first instead of myself - even though I was the one coming down to the school several times a week (sometimes several times a day) due to a high-needs situation.

Even after we asked them to put a big notice in our records saying to try ringing me first. This is in Melbourne, Australia.
Sure, but what odds do you give to that happening in the near future?
This is such a startlingly uncharitable response that I don't know how to react. Where is this coming from? Who said anything about being a self-proclaimed "ally"? What do TikTok and Twitter have to do with this? It sounds less like you're here for a conversation about race and class and more like you have a need to unpack the distorted perceptions that one internet subculture has for another internet subculture.
In my personal experience, this isn't a question of either/or, it's a question of order. That is, courses are fantastic, but most of the time, they're more beneficial after you've done some JIT learning.

Fastai, who in my opinion create the best educational resources in the deep learning space, are a great example of this. They use a metaphor involving sports to explain their approach. You don't learn to play a sport by pouring over rulebooks and studying professionals—you start playing. However, as you get a feel for the sport, you then find yourself in a position where learning a lot more about the theory of the game would make a huge difference to you, and that's where courses come in. Similarly, they get you off the ground quickly with some basic intuitions around deep learning, give you a sandbox to do some JIT learning, and then begin layering in deeper concepts.

I've had similar experiences in my life, where taking graduate level courses was incredibly rewarding specifically in areas where I'd already spent a decent amount of time doing JIT learning—and arguably, where I'd reached a relative limit in how far JIT would take me.
“Can’t argue with the benefits of the trickle down effect of wealth”... yes I think decades of economic doctrine have covered the benefits. Probably should keep in mind other things like the consequences
So, progressive enhancement?
> the "professionals" are bothered that the "idiots on WSB" are making a mockery of the market

I think it's deeper. if they get forced by a margin call to purchase stock people that shorted without a lend will quickly come under scrutiny from sec, which will be quite interested to know which broker(s) allowed to reach this ridiculous float volume without securing the shares

they're not just covering their losses, whose whom will remain with uncovered short can get fines and or jail time.
Aren't there going to be multiple falls here. The one you mentioned and when the stock falls back to its "real" value?
So like the Centralia fire?
It's hard to maintain employment if you are evicted from your home, especially if you have a family. You have to move in with extended family/friends and, thus, may no longer be within commuting distance of your job.

Or you could end up homeless/couch surfing and that is also very difficult for staying employed.
Why not have the client stored in a dictionary, it's just a url location, instead of having a dataclass? You don't even need a "construct_url" function.
Ruby 3.0 / Facebook Live with Bozhidar Batsov / Spark Academy 2021
Hi there :)

I'm organizing this free, short online workshop on Ruby 3.0 - it's happening on Thursday, Jan 28th at 6.30 pm (GMT+1). Our Special Guest will be Bozhidar Batsov, the creator of RuboCop.

Please be invited to join the stream and the discussion - it's a Facebook Live event:
https://www.facebook.com/events/236260631219763
Nobody has solved it because there is nothing to solve. That's like saying that "we to optimize SQL for UX". No, no we don't.

Fetching data has nothing to do with managing state, rendering UI, or even UX. Each layer has different problems it needs to address.

And btw you can totally do GraphQL requests with fetch().
OT, but this is one of the main reasons I tend to code on a laptop. Going back and forth to the trackpad is much easier and faster than going to a separate mouse
Anyone remember Iomega and zip drives? This same thing happened iomega stock price which was driven up by Yahoo message boards/Motley Fool.

"At the close of trading Wednesday, Utah-based Iomega was worth more than Hershey Foods and had twice the market value of Apple Computer."

https://www.deseret.com/1996/5/23/19244215/fools-rush-in-sen...
Pai did try to push companies to adopt authenticated calls voluntarily. His hand was forced by congress later on https://arstechnica.com/tech-policy/2020/04/ajit-pai-follows...

I guess in theory at some point this year everyone will have gotten on board by the deadline and the telcos can start providing more technical options to stomp out the calls.
Gitlab is a very broad product and not just limited to Enterprise users. Some of us are in startups and others are introducing Gitlab in their companies from the bottom up. For these groups the new pricing is a big setback.
The wall street casino recoils in horror that some people are good at counting cards at black jack stock market and teaching millions in how to count cards at black jack stock market.
I enabled it for my media storage, knowing that it wouldn't matter much, and indeed it doesn't. Compressratios are 1.00, 1.00 and 1.01.
Is that a real concern though? The ACA provides income-based funding and expanded Medicaid.
Those drugs need to be tested and certified by the FDA before they're legal in the US. For a lot of lower volume drugs, the cost and time to go do that ishigh enough (vs the potential gain) that companies don't bother.
If we step into the haskell land of monads having explicit functionality kept in individual monads with their own instances would be one way to segment this type of stuff. Something vaguely written as below would let you run actions where anyone can move or is an enemy, and default implementations can be provided as well.

data Demon = { ... }

data Action
= Dead
| KnockedBack
| Polymorphed

class Character a where
health :: Int

class (Character a) => Movement a where
speed :: Int

class (Character a) => Enemy a where
kill :: a -> Action
damage :: a -> Action

instance Character Demon where
health = 30

instance Movement Demon where
speed = 5

instance Enemy Demon where
kill _ = _
damage _ = _

https://soupi.github.io/rfc/pfgames/ is a talk going through an experience building a game in a pure fp way with Haskell and how they modelled certain aspects of game dev. Most of the code examples are when you press down in the slides.
Indeed.

Those of us with stable housing take a lot of things for granted.

“I’ll just shower at the gym.” Turns a shower from a 20-minute operation to more than an hour.

Food storage and preparation.

Clothing storage, care, and maintenance.

Not to mention that getting homeless in the first place happens because of lack of resources (or poor allocation of barely sufficient resources).

Then on top of that, an eviction on your credit report makes it harder to find a new place.

And finding a place is hard and time-consuming. Not even taking into account the deposits and other costs.
I don't know why you're being voted down here. These are legitimate articles in major publications that are broadly accepted by experts in the field. Sad!
There is no way that this is a realistic cost.

If someone quoted you $200,000/person for building a 1 million person city from scratch in the middle of the desert, it would be a lowball figure.

The Masdar city in Abu Dhabi was planned to cost $20 billion and house 40k people. That's $500,000/person, right here on Earth where breathable air and protection from cosmic radiation is completely free of charge, and you don't need to launch anything out of Earth's gravity well.

So if Musk had a realistic way of reaching $200,000/person, he could start doing it on Earth and completely fund his Mars project purely from the profits of selling the Earthside city to someone else here on Earth.
Regardless of any involvement of a government or any factors of corruption - I'm just purely interested in the fact that nature could sustain a fire like this in -50C weather.
While the article is good in that it highlights the issue, I found it disheartening that all the interviewees where mothers. Where's the interviews with the fathers saying how invalidated as a parent it makes them feel? Seems to be some irony there.
Please don't editorialize titles like this. It's against the site guidelines, and accounts that do it eventually lose submission privileges.

"Please use the original title, unless it is misleading or linkbait; don't editorialize."

https://news.ycombinator.com/newsguidelines.html
Obligatory quote from Judge Learned Hand:

"Anyone may arrange his affairs so that his taxes shall be as low as possible; he is not bound to choose that pattern which best pays the treasury. There is not even a patriotic duty to increase one's taxes. Over and over again the Courts have said that there is nothing sinister in so arranging affairs as to keep taxes as low as possible. Everyone does it, rich and poor alike and all do right, for nobody owes any public duty to pay more than the law demands."
The two biggest rants on HN are 1) Why doesn't this site work without JavaScript? It's inaccessible. and 2) Why doesn't this app work offline? It invades my privacy.

Maybe I'm wrong, but as far as I can tell, you can't have both. Sorry folks.

You are right, JS is not needed if the site truly is static content. But if you try to make an interactive app that could be implemented client-side (AKA javascript) and attach a server to it, everybody will complain that the application doesn't respect the user's privacy, since it could be offline-only but it's not.

Don't get me wrong, I think "interactive" can meaningfully include a simple site with links if you are looking at it from a privacy angle. Just look at how StackOverflow recently was able to track all the pages their hacker viewed. [1] SO is pretty much static content. So do you want StackOverflow to work without JavaScript? Are you happy that in-so-doing it needs to phone home whenever you look something up? You can't have one without the other.

There is also the argument from scalability. You'll get less QPS on your servers if you implement a 3-step form with validation in the frontend, and send off all the data in one go. It's also faster/better UX and is more resilient under bad network conditions.

Edge computing is maybe an alternative there, but that doesn't address inherent privacy concerns of phoning home to a server.

Last there is the reality of a spectrum of interactivity of websites. If you are doing a blog, sure, don't do it in JS. At that point you make a decision to make it difficult to add any interactive features to you site which require JS. If you are building an evolving app with interactive features, there aren't many options for easily mixing static HTML with interactive JS. You could see how far you get with static HTML but then what if you need interactivity (JS/JQuery)? What if you need complex interactivity (React)? Are you willing to pay the costs of a heterogeneous app architecture of HTML mixed with interactive JS?

Think of Facebook. It is kinda like a blog, but what about infinite scroll? Etc.

Anyway that last point, I think, is why people are excited about 37signals' Hotwire[2]. It's more of a HTML-but-interactive architecture as opposed to the fully-interactive JS/React vs static HTML forms.

[1]: https://stackoverflow.blog/2021/01/25/a-deeper-dive-into-our...
[2]: https://hotwire.dev/
Lots of space down at NASA/CCAS, and nearly all of the original launch pads are still intact (but in a state of decay). There is historical value to everything, but it must be weighed against the need for modern facilities. Sure there were some historic launches from MLP-2, but IMHO that does not justify turning it into a museum. There's a nice museum (and rocket garden) just a few miles away at the Visitor Center.
Hi, I think you're correct in some domains - I probably should have spelt out that I'm by-and-large talking about application development, where if you have a "sufficiently complex combination of state and code" you probably have a problem rather than a candidate for wrapping in a class.
I find fault in your reasoning. Let me explain.

This is a game theory problem with perverse incentives where regulation and law enforcement are needed. If CEO A (in this case Martin Shkreli) were to take the "moral high ground" and behave acceptably, the board of directors would look at similar companies performing 10x better, fire him and replace him with someone less moral.

If the board were to take the "moral high ground" the shareholders would value the company many times lower, and they'd be bought out for pennies by an acquirer willing to take the low road because that would be a super profitable move.

If moral shareholders refuse to buy the shares of low-road companies, the value of the shares fall, but the profits don't, and suddenly being "amoral" is super profitable for stock investors, and there are always some, and they will be richer than moral shareholders. As amoral investors amass riches, they will deploy greater amounts of capital using amoral valuations, which will then dominate.

So the whole system is broken, and personal ethics does nothing to fix the game. In a nutshell, this is also why libertarianism is broken.
I work in an innovation ML-oriented lab, and we have a hard time identifying use cases with real added values.

So I wondered: who had the initiative to use ML in riviera, the riviera team or the ML team? How do you collabore between the two teams/worlds (production team and data science team)?
I know that the article specifically says that ASLR was defeated, but I wonder if these other compiler/linker mitigations prevent (some of) these vulnerabilities (specifically fortify)?

The "hardening-check" perl script is available from EPEL on redhat platforms. Here I use it to report mitigations in an old FWTK component that I use for an internal legacy system.

$ hardening-check /home/fwjail/usr/local/etc/ftp-gw
/home/fwjail/usr/local/etc/ftp-gw:
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: yes

$ rpm -qi hardening-check | grep ^URL
URL : http://packages.debian.org/hardening-wrapper
They discontinued that in 2022.
There is no single solution, the world isn’t that neat however the NHS problems and it does have them are a result in large part to it been a political football for decades.

Even with those problems we spend about half per capita on healthcare with about equal outcomes, also the US gov in one form or another already foots about 50% of the bill itself.

> Results The UK spent the least per capita on healthcare in 2017 compared with all other countries studied (UK $3825 (£2972; €3392); mean $5700), and spending was growing at slightly lower levels (0.02% of gross domestic product in the previous four years, compared with a mean of 0.07%). The UK had the lowest rates of unmet need and among the lowest numbers of doctors and nurses per capita.

https://www.bmj.com/content/367/bmj.l6326

They do more for less with less and mostly do it well.

Compare that to any other major country and it’s good, compared to the US system it’s very good.

Does the US have amazing doctors, hell yeah of course but do they have a fair system when on average everyone gets what they need if not always what they want, I’d argue no.
You're off by a factor of 100.
Yeah. <img> tags for presentation (with no `alt` attr).

Form <input>s without <label>s.

No skip link, no landmark regions.

<table>s with <div>s inside for non-tabular content.

<font> tags. FONT TAGS.

"A breath of fresh hair" is a typo that accidentally makes a good comparison.
Actually I like it that an investor gives his name to a company. Usually problems start when he’s not the main owner anymore though....
>He didn’t have any answer as to fate of new bag holders he created with his tweet.

I don't know what answer you expect him to give. Are you saying that people shouldn't be allowed to tweet their trades? Also it's ridiculous to think WSB isn't full of bagholders - I've seen people blow up their accounts on completely ridiculous trades they had researched on their own. Are you saying people shouldn't be allowed to make bad trades?

Chamath answers the question correctly; the question you're asking implies that you don't think retail should be trusted to invest. If that's truly what you think then say it proudly.
Do you have insurance? I fail to she how being healthy and not self-employed affects the scenario as described (present card, get treated, recieve a bill).
Would lying not be a crime here? Maybe not if the position was all from their personal accounts. But wouldn't it be a problem if you were trading other people's money, and you ended up on the losing end, wouldn't you have problems with lawsuits from your clients, saying they were duped, and they would have pulled their money out, if not for this lie? (Or something similar)
It does seem tiny, and my first thought was "how many dollars did they burn to save those $1.7M", but that was one of the first things they evaluated, and both the research phase and operational burden of running the service seem to be relatively small so that the investment definitely paid off. It's great that they're talking real numbers, loved the post in general!
How do you practically ban lobbying without removing the ability of private citizens to directly interact with the legislature? There are good reasons to allow groups of people to get together and pay someone to go hassle congress on their behalf. Regular people are busy with their own lives after all, and most of them live far away from Washington. And sometimes you want to complain to a representative from outside of you own district, because they're sponsoring legislation that would hurt you, or blocking legislation that would help you.
Given the name and positioning of this business, I would say it's partly a PR stunt and partly an act of charity (a non-charitable approach would be to undercut by only 30-50% instead of 90%).

So yeah... it's great that billionaires occasionally step up to "fix" issues created by corruption and inadequate regulation/oversight, but I think if you're going to take a position that this is somehow better than waiting for the system to fix it, it might be more instructive to look at how this works in countries with a functioning bureaucracy. For example the drug given on the homepage is Albendazole, which they're selling for $20— well guess what, that pill is $2 in the UK and has been since the patent expired in the 90s:

> "In other countries, there are price control methods. The government steps in to ensure drug prices do not increase by a certain amount," Alpern says. "There are no price control mechanisms in the U.S."

https://www.npr.org/sections/goatsandsoda/2017/12/11/5677534...
Albendazole can be found for US$ 1 in drugstores in Brazil.
How many years does it have to last, before it's "built to last?" I've seen lots of Ikea couches that have lasted a long time.
But it isn't different to be the one who shorted past 100% and to be the one who shorted earlier when other people shorted past 100%.